An encrypt storage target is configured with two other storage targets:
one to hold encrypted blobs, and one to hold encrypted metadata about
the encrypted blobs. On start-up, all the metadata blobs are read
to discover the plaintext blobrefs.

Encryption is currently always AES-128. See code for metadata formats
and configuration details, which are currently subject to change.